CVE-2026-15690
LowCVSS 3.1Summary
A vulnerability was found in open62541 up to version 1.5.5, affecting the function responseReadNamespacesArray in src/client/ua_client_connect.c. Manipulation of the Server_NamespaceArray argument causes a null pointer dereference, potentially leading to application crashes. The attack can be executed remotely but requires high complexity and is difficult to exploit.
Risk Assessment
The risk for the organization is the potential for remote crashes of applications using the open62541 library, which could disrupt critical services. The publicly available exploit increases the attack likelihood, though its complexity limits the threat scope.
Recommendation
It is recommended to immediately update open62541 to a version newer than 1.5.5 if available. If no patch exists, restrict network access to interfaces using the vulnerable component and monitor logs for exploitation attempts.
Original NVD description (English source)
A vulnerability was identified in open62541 up to 1.5.5. Affected by this issue is the function responseReadNamespacesArray of the file src/client/ua_client_connect.c of the component Shared Client Library. Such manipulation of the argument Server_NamespaceArray leads to null pointer dereference. The attack can be executed remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit is publicly available and might be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.